@jini-ai/daemon 0.6.10 → 0.6.11

package/CHANGELOG.md

@@ -1,3 +1,16 @@
+## 0.6.11
+
+### Patch Changes
+
+- Mid-run message relay for MCP-bridged engines (Codex, ACP, Antigravity): `registerMessageRelayRoutes` on `@jini-ai/daemon/http`; mid-run messages queue instead of interrupting, and recovery waits on an uncertain probe.
+- Site agents are confined to the site folder: Claude file tools are bounded to the site root and private temp dir, and attachments are staged inside the site (`stageAttachmentClaim`).
+- Tool inputs apply a sole near-miss and declared input aliases; plugin-load outcomes are reported; `web_fetch` reads SVG/JS as text; `content_read` suggests its resource first; the browser falls back to system Chrome.
+- Updated dependencies
+- Updated dependencies
+- Updated dependencies
+  - @jini-ai/core@0.6.11
+  - @jini-ai/protocol@0.6.11
+
 ## 0.6.10
 
 ### Patch Changes

package/dist/agent-executor/contracts.d.ts

@@ -4,8 +4,8 @@ import type { MessageAttachmentImage } from '../attachment-content.js';
 import type { probeMcpBridge } from './mcp-bridge-probe.js';
 import type { spawn as nodeSpawn, ChildProcess } from 'node:child_process';
 import type { Principal } from '@jini-ai/core';
-import type { RunAgentPayload, RunErrorPayload } from '@jini-ai/protocol';
-import type { AgentRuntimeState, applyAgentLaunchEnv, ensureAgentCapabilities, resolveModelForLaunch, getAgentDef, resolveAgentLaunch, attachAcpSession, attachPiRpcSession, prepareAgentLogFile, preparePromptFileForAgent, AcpMcpServerInput, AcpPermissionHandler, PromptAugmenter } from '@jini-ai/agent-runtime';
+import type { RunAgentPayload, RunErrorPayload, MessageRelayVia, RelayedUserMessage } from '@jini-ai/protocol';
+import type { AgentRuntimeState, applyAgentLaunchEnv, ensureAgentCapabilities, assertClaudeFilesystemSupport, resolveModelForLaunch, getAgentDef, resolveAgentLaunch, attachAcpSession, attachPiRpcSession, prepareAgentLogFile, preparePromptFileForAgent, AcpMcpServerInput, AcpPermissionHandler, PromptAugmenter } from '@jini-ai/agent-runtime';
 import type { createCommandInvocation } from '@jini-ai/platform/command';
 import type { listProcessSnapshots, ProcessSnapshot, StopProcessesResult } from '@jini-ai/platform/process';
 import type { RunByteJournal } from '../continuation/journal.js';
@@ -94,7 +94,7 @@ export type AgentRuntimeEventTranslation = {
     readonly kind: 'ignored';
 };
 /** Machine-readable failure reasons `run()` can reject with — every one is preceded by a `lifecycle.finish({status:'failed'})` call (see index.ts module doc's Invariant section). */
-export type AgentExecutorErrorCode = 'NATIVE_TOOL_POLICY_UNSUPPORTED' | 'AGENT_MODEL_UNRESOLVED' | 'AGENT_PERMISSION_MODE_INVALID' | 'AGENT_NOT_FOUND' | 'AGENT_RUNTIME_UNSUPPORTED' | 'AGENT_BINARY_NOT_RESOLVED' | 'AGENT_SPAWN_FAILED' | 'AGENT_PROMPT_TOO_LARGE';
+export type AgentExecutorErrorCode = 'FILESYSTEM_POLICY_UNSUPPORTED' | 'FILESYSTEM_POLICY_INVALID' | 'NATIVE_TOOL_POLICY_UNSUPPORTED' | 'AGENT_MODEL_UNRESOLVED' | 'AGENT_PERMISSION_MODE_INVALID' | 'AGENT_NOT_FOUND' | 'AGENT_RUNTIME_UNSUPPORTED' | 'AGENT_BINARY_NOT_RESOLVED' | 'AGENT_SPAWN_FAILED' | 'AGENT_PROMPT_TOO_LARGE';
 /** Thrown by `AgentExecutor.run()` on every failure path — never a bare `Error`, so callers can branch on `.code` instead of parsing `.message`. */
 export declare class AgentExecutorError extends Error {
     readonly code: AgentExecutorErrorCode;
@@ -104,6 +104,8 @@ export declare class AgentExecutorError extends Error {
     });
 }
 export interface AgentExecutorRunInput {
+    /** Host-selected mandatory filesystem boundary; no user grant may widen it. */
+    readonly filesystemRoot?: string;
     readonly runId: string;
     readonly agentId: string;
     readonly prompt: string;
@@ -205,28 +207,35 @@ export interface AgentExecutor {
      * underlying run is always already transitioned to `'failed'` via
      * `lifecycle.finish()` before this rejects (see index.ts module doc's Invariant).
      */
-    run(requiredArgs: Pick<AgentExecutorRunInput, "runId" | "agentId" | "prompt" | "cwd">, optionalArgs?: Pick<AgentExecutorRunInput, "model" | "reasoning" | "nativeToolAccess" | "nativeCapabilities" | "cliParity" | "permissionMode" | "imagePaths" | "imageContents" | "extraAllowedDirs" | "uploadRoot" | "credentialEnv" | "env" | "resumeSessionId" | "newSessionId" | "disallowedTools" | "allowedTools" | "settingSources" | "settings" | "chromeIntegration">): Promise<void>;
+    run(requiredArgs: Pick<AgentExecutorRunInput, "runId" | "agentId" | "prompt" | "cwd">, optionalArgs?: Pick<AgentExecutorRunInput, "filesystemRoot" | "model" | "reasoning" | "nativeToolAccess" | "nativeCapabilities" | "cliParity" | "permissionMode" | "imagePaths" | "imageContents" | "extraAllowedDirs" | "uploadRoot" | "credentialEnv" | "env" | "resumeSessionId" | "newSessionId" | "disallowedTools" | "allowedTools" | "settingSources" | "settings" | "chromeIntegration">): Promise<void>;
     /**
      * Delivers a message the human sent while `runId` is going straight into its live agent process
-     * (see {@link UserMessageDelivery} for each outcome). A stream-json agent is interrupted first and
-     * gets the message once the CLI acknowledges the interrupt, so this settles in milliseconds (at
-     * most `INTERRUPT_ACK_TIMEOUT_MS`); it never waits on the agent's reply.
+     * (see {@link UserMessageDelivery} for each outcome). A stream-json agent queues the message
+     * directly without interrupting tools. This settles on write acceptance; consumption is reported
+     * separately by UUID receipts. It never waits on the agent's reply.
      * Optional `imageContents` contains host-authorized pixels, encoded exactly as in an idle send.
      */
     sendUserMessage(requiredArgs: {
         readonly runId: string;
         readonly text: string;
+        readonly id?: string;
+        readonly attachmentIds?: readonly string[];
     }, optionalArgs?: {
         readonly imageContents?: readonly MessageAttachmentImage[];
     }): Promise<UserMessageDelivery>;
+    /** Trusted transport supplies the credential-bound run, never model arguments. No I/O or waiting. */
+    claimUserMessages(input: {
+        readonly runId: string;
+        readonly via: MessageRelayVia;
+    }, options?: Record<string, never>): readonly RelayedUserMessage[];
 }
 /**
  * What {@link AgentExecutor.sendUserMessage} did with a mid-run message:
- * - `'delivered'` — the running turn was interrupted and the message written into the live
+ * - `'delivered'` — the message was queued without interruption into the live
  *   session; the agent answers it next, in the same process and session.
  * - `'unsupported'` — the run is live, but its agent has no way to take input mid-run (its prompt
  *   is plain text or an RPC request). Queue attachment turns intact after the reply; text-only
- *   turns may retain the interrupt-and-resume fallback.
+ *   turns retain the next-turn queue fallback.
  * - `'not-running'` — no live process will accept it: an unknown run, a finished one, or one whose
  *   last turn already ended and closed stdin. The run is ending; the host should send it next.
  */
@@ -273,8 +282,14 @@ export interface StdinCloseHandle {
     closeStdinOnce(): void;
     /** Journals a sent-to-stdin byte chunk, queued through the same FIFO {@link wireChildLifecycle} already uses for emitted events. No-op when no journal was configured (see `CreateAgentExecutorOptions.journal`). */
     recordSentBytes(content: string): void;
-    /** Interrupts this child's turn, then writes a mid-run user message into its open stdin — see {@link AgentExecutor.sendUserMessage}. */
-    sendUserMessage(text: string, imageContents?: readonly MessageAttachmentImage[]): Promise<UserMessageDelivery>;
+    /** Queues a mid-run user message into this child's open stdin — see {@link AgentExecutor.sendUserMessage}. */
+    sendUserMessage(input: {
+        text: string;
+        id?: string;
+        attachmentIds?: readonly string[];
+    }, options?: {
+        imageContents?: readonly MessageAttachmentImage[];
+    }): Promise<UserMessageDelivery>;
 }
 /**
  * Gap 3 (capability-routed continuation transport) — host-owned config for the
@@ -622,6 +637,8 @@ export interface CreateAgentExecutorOptions {
     readonly resolveAgentLaunch?: typeof resolveAgentLaunch;
     /** @default the real `@jini-ai/agent-runtime` once-per-binary `--help` capability probe */
     readonly ensureAgentCapabilities?: typeof ensureAgentCapabilities;
+    /** Bounded version/enforcement probe; replaceable for offline host tests. */
+    readonly assertClaudeFilesystemSupport?: typeof assertClaudeFilesystemSupport;
     /** @default the real `@jini-ai/agent-runtime` PATH-env composer */
     readonly applyAgentLaunchEnv?: typeof applyAgentLaunchEnv;
     /** @default the real `@jini-ai/platform` cross-platform invocation builder */

package/dist/agent-executor/events.d.ts

@@ -1,5 +1,6 @@
 import type { DelegatedResultCorrelation } from '../delegated-result-correlation.js';
 import type { StdoutJournalBlobPort } from '../tool-result-diagnostics.js';
+import { type RunMessageRelay } from './message-relay.js';
 import type { probeMcpBridge } from './mcp-bridge-probe.js';
 import type { ModelCatalogSnapshot } from '@jini-ai/agent-runtime';
 import type { ChildProcess } from 'node:child_process';
@@ -26,6 +27,7 @@ export declare function defaultCleanupFailureSink(context: AgentCleanupFailureCo
  */
 export declare const DEFAULT_BUFFERED_STDOUT_MAX_BYTES: number;
 interface WireChildLifecycleContext extends TerminateChildTreeDeps {
+    readonly registerMessageRelay?: (relay: RunMessageRelay) => void;
     readonly delegatedResultCorrelation?: DelegatedResultCorrelation;
     readonly stdoutJournalBlobs?: StdoutJournalBlobPort;
     readonly startingModel?: string;
@@ -125,21 +127,6 @@ interface WireChildLifecycleContext extends TerminateChildTreeDeps {
  * @overallScore 100/100
  */
 export declare function wireChildLifecycle(ctx: WireChildLifecycleContext): StdinCloseHandle;
-/**
- * Whether a def's live process can take another user message mid-run: only a stream-json stdin
- * transport keeps stdin open for more JSONL user lines (see `RuntimeAgentDef.promptInputFormat`).
- * Deliberately not `resolveContinuationTransport`: that answers how a tool result gets back, and
- * reports `'mcp-callback'` for Claude even though its stdin takes user lines all the same.
- */
-export declare function acceptsMidRunUserMessages({ def }: {
-    readonly def: RuntimeAgentDef;
-}): boolean;
-/**
- * How long a mid-run message waits for the CLI to acknowledge its interrupt before being written
- * anyway. Claude Code acks within milliseconds (it answers before the aborted turn's own result);
- * the ceiling only bounds an agent that ignores control requests.
- */
-export declare const INTERRUPT_ACK_TIMEOUT_MS = 5000;
 /**
  * Writes the initial user turn to the child's stdin per `def.promptInputFormat`
  * (both branches only run for `promptViaStdin: true` defs — the only shape
@@ -174,6 +161,7 @@ interface RunAcpDispatchInput {
     readonly mcpBridge: McpBridgeDelivery | null;
 }
 interface RunAcpDispatchDeps extends TerminateChildTreeDeps {
+    readonly registerMessageRelay?: (relay: RunMessageRelay) => void;
     readonly lifecycle: RunLifecycle;
     readonly attachAcpSession: typeof attachAcpSession;
     readonly onPermissionRequest: AcpPermissionHandler | undefined;

package/dist/agent-executor/events.js

@@ -1,5 +1,7 @@
 import { createToolResultDiagnosticProjection, projectDiagnosticFrame } from '../tool-result-diagnostics.js';
 import { appendSerialTask } from "@jini-ai/core/primitives";
+import { createLiveSessionState } from './live-session-state.js';
+import { acceptsMidRunUserMessages, createMessageRelay } from './message-relay.js';
 import { randomUUID } from 'node:crypto';
 import { createModelReceiptTracker } from './model-receipts.js';
 import { observeRunOutput } from './run-output.js';
@@ -203,6 +205,16 @@ export const DEFAULT_BUFFERED_STDOUT_MAX_BYTES = 8 * 1024 * 1024;
 function bufferedStdoutTruncationNotice(droppedBytes, maxBytes) {
     return `\n[jini] agent stdout truncated: ${droppedBytes} byte(s) dropped after the ${maxBytes}-byte buffer limit was reached.\n`;
 }
+/** Install once on a driver's FIFO; close synchronously before any terminal handler yields.
+ * Native runs omit registration, so they allocate no relay and emit only CLI receipts. */
+function attachMessageRelay({ register, emit, child }) {
+    if (!register)
+        return undefined;
+    const relay = createMessageRelay({ emit });
+    register(relay);
+    child.once('close', () => relay.close());
+    return relay;
+}
 /** Keeps exact-byte auditing separate from retained diagnostics on the run's existing FIFO.
  * Projection retains at most one bounded frame; ordinary stdout keeps its legacy byte journal. */
 function createStdoutDiagnostics({ ctx, enqueueEmit }, _options = {}) {
@@ -314,9 +326,8 @@ export function wireChildLifecycle(ctx) {
     // only ever acted on when a host has explicitly allowlisted the tool's name.
     let pendingToolUse;
     // Observe the canonical lifecycle, including delegated calls that bypass the CLI parser.
-    // A single latest tool_use cannot represent parallel tools at an interrupt boundary.
+    // A single latest tool_use cannot represent all parallel calls at explicit cancellation.
     const unresolvedToolCalls = new Set();
-    const interruptedToolCalls = new Set();
     const toolSubscription = lifecycle.stream({ runId, onEvent: (event) => {
             if (event.kind !== 'agent')
                 return;
@@ -332,9 +343,9 @@ export function wireChildLifecycle(ctx) {
     });
     /** Run on the same FIFO as parsed results, after the aborted segment has drained.
      * O(t) in unresolved calls; completed results are never replaced with cancellation. */
-    async function cancelUnresolvedToolCalls(ids) {
+    async function cancelUnresolvedToolCalls() {
         await toolSubscription;
-        for (const toolUseId of ids ?? [...unresolvedToolCalls]) {
+        for (const toolUseId of [...unresolvedToolCalls]) {
             if (!unresolvedToolCalls.has(toolUseId))
                 continue;
             await lifecycle.emit({ runId, input: { event: 'agent', data: {
@@ -373,71 +384,46 @@ export function wireChildLifecycle(ctx) {
         stdinClosed = true;
         child.stdin?.end();
     }
-    // Mid-run interrupts (see `sendUserMessage` below): each sent `interrupt` control request waits
-    // here, by request id, for the CLI's `control_response`. Settled with `true` on the ack, `false`
-    // when the process exits first. Bounded by the mid-run messages in flight on this one run.
-    const pendingInterruptAcks = new Map();
-    // Set once this run has interrupted its agent: from then on a turn the interrupt aborted
-    // (`aborted_*` stop reason) is not the run's last — the message that follows starts a new one.
-    let interruptSent = false;
-    // Claude Code's background tasks still running (a subagent or shell it started in the
-    // background), from its latest `background_tasks_changed` line, which lists them all. While any
-    // runs, an `end_turn` is not the run's end: the CLI keeps going until they finish and reports on
-    // them, so stdin must stay open for mid-run messages. Closing it there (2026-10-10, plannie chat)
-    // made every message sent while two subagents worked come back 'not-running' and wait for the run
-    // to end — and at EOF the CLI stops background tasks at its own wait ceiling (10 minutes).
-    let backgroundTaskCount = 0;
-    // Set when a turn ended and stdin stayed open only for background tasks: no turn is running, so a
-    // mid-run message has nothing to interrupt, and the last task finishing closes stdin (below).
+    // Unanswered UUIDs and the CLI's queued_turn_count keep stdin open across intermediate turn ends.
+    // Consumption is confirmed by CLI reply/result attribution, never by HTTP delivery or an echo.
+    const emitInput = (data) => enqueueEmit(() => lifecycle.emit({ runId, input: { event: 'agent', data } }));
+    const session = createLiveSessionState({ emit: emitInput });
+    const relay = attachMessageRelay({ register: ctx.registerMessageRelay, emit: emitInput, child });
+    // Claude's background tasks can outlive a parent turn. Keep the existing hold until the last
+    // task finishes; closing stdin early stops them at the CLI's background-wait ceiling.
+    // 2026-10-10 (plannie chat): closing at the parent's end_turn made messages return
+    // 'not-running' for ten minutes, then EOF killed the still-working subagents at that ceiling.
     let heldForBackgroundTasks = false;
-    // stdout carry-over for the control lines below; holds at most the current partial line.
+    let heldForQueuedInput = false;
     let controlScanBuffer = '';
-    /** Resolves the waiting interrupt this `control_response` line acknowledges, if any. @complexity O(line length). */
-    function settleInterruptAck(line) {
-        const requestId = controlResponseRequestId({ line: line });
-        const settle = requestId === undefined ? undefined : pendingInterruptAcks.get(requestId);
-        if (!settle)
-            return;
-        pendingInterruptAcks.delete(requestId);
-        settle(true);
-    }
-    /**
-     * Tracks a `background_tasks_changed` line. The last background task finishing while stdin is
-     * held only for them closes it, exactly as the turn end would have: the CLI then answers what it
-     * still owes (the tasks' report) and exits. @complexity O(line length).
-     */
-    function updateBackgroundTasks(line) {
-        const count = backgroundTaskListLength({ line: line });
-        if (count === undefined)
-            return;
-        backgroundTaskCount = count;
-        if (count === 0 && heldForBackgroundTasks) {
-            heldForBackgroundTasks = false;
-            closeStdinOnce();
-        }
-    }
-    /**
-     * Reads the stdout lines a mid-run message depends on: interrupt acks and background-task
-     * changes. Only agents that take mid-run messages are scanned. A chunk with no newline is only
-     * appended, so a long line split across many chunks is split once, not once per chunk.
-     * @complexity O(chunk length) amortized.
-     */
+    /** Scan and parse in wire order: a receipt later in a chunk cannot affect an earlier turn end.
+     * O(chunk length) amortized; only the partial line remains buffered. */
     function scanControlLines(text) {
-        if (!acceptsMidRunUserMessages({ def: def }))
-            return;
         controlScanBuffer += text;
         if (!text.includes('\n'))
             return;
-        // `text` holds a newline, so the buffer does: split off the complete lines, keep the partial tail.
         const lastNewline = controlScanBuffer.lastIndexOf('\n');
         const lines = controlScanBuffer.slice(0, lastNewline).split('\n');
         controlScanBuffer = controlScanBuffer.slice(lastNewline + 1);
-        for (const line of lines) {
-            // Both checked: either word can also appear inside the other kind of line's text.
-            if (line.includes('"control_response"'))
-                settleInterruptAck(line);
-            if (line.includes('"background_tasks_changed"'))
-                updateBackgroundTasks(line);
+        for (const line of lines)
+            feedSessionLine(line);
+    }
+    function feedSessionLine(line) {
+        const observed = session.observe({ line });
+        if (observed.startedInput)
+            heldForQueuedInput = false;
+        streamHandler.feed({ chunk: `${line}\n` });
+        if (session.hasPendingInput())
+            return;
+        if (heldForBackgroundTasks && session.backgroundTaskCount() === 0) {
+            heldForBackgroundTasks = false;
+            closeStdinOnce();
+        }
+        // A result can lower queued_turn_count after the assistant end already held stdin open.
+        // Re-evaluate that held end after parsing the result (the parser deduplicates turn ends).
+        if (observed.result && heldForQueuedInput && session.backgroundTaskCount() === 0) {
+            heldForQueuedInput = false;
+            closeStdinOnce();
         }
     }
     /**
@@ -459,25 +445,15 @@ export function wireChildLifecycle(ctx) {
         if (journal)
             enqueueEmit(() => journal.record({ runId: runId, entry: sentJournalEntry(content) }));
     }
-    /**
-     * Whether a `turn_end` leaves stdin open for a live agent that takes mid-run messages — and why:
-     * `'background-tasks'` when only background tasks keep the run going (no turn runs until the next
-     * message or task report), `'turn-continues'` for the reasons below, `'close'` otherwise. Open
-     * because the run is not over: a `tool_use` stop (the CLI runs the tool itself and carries on, and a
-     * message sent while the tool runs must still reach it), any end while an interrupt still waits
-     * for its ack (the message is about to be written), and the end of a turn an interrupt aborted
-     * (the message written after it starts the next turn), and any end while background tasks still
-     * run (see `backgroundTaskCount`). Every other end closes stdin, so the CLI exits once it has
-     * answered everything written before EOF.
-     */
+    /** A tool_use end is intermediate: the CLI executes that batch itself and carries on.
+     * Pending input and background tasks also owe work. Every other end closes stdin so the CLI
+     * exits once it has answered everything written before EOF. */
     function stdinHoldAfterTurnEnd(stopReason) {
-        if (!acceptsMidRunUserMessages({ def: def }))
+        if (!acceptsMidRunUserMessages({ def }))
             return 'close';
-        if (stopReason === 'tool_use' || pendingInterruptAcks.size > 0)
-            return 'turn-continues';
-        if (interruptSent && stopReason !== undefined && stopReason.startsWith('aborted'))
+        if (stopReason === 'tool_use' || session.hasPendingInput())
             return 'turn-continues';
-        return backgroundTaskCount > 0 ? 'background-tasks' : 'close';
+        return session.backgroundTaskCount() > 0 ? 'background-tasks' : 'close';
     }
     /**
      * Decides, per `turn_end`, whether to auto-resolve a pending tool_use through the injected
@@ -486,11 +462,6 @@ export function wireChildLifecycle(ctx) {
      * unconfigured or the pending tool isn't allowlisted).
      */
     function handleTurnEnd(stopReason) {
-        if (stopReason?.startsWith('aborted'))
-            enqueueEmit(async () => {
-                await cancelUnresolvedToolCalls([...interruptedToolCalls]);
-                interruptedToolCalls.clear();
-            });
         const toolUse = pendingToolUse;
         const shouldInject = stopReason === 'tool_use' &&
             toolUse !== undefined &&
@@ -500,6 +471,7 @@ export function wireChildLifecycle(ctx) {
         if (!shouldInject) {
             const hold = stdinHoldAfterTurnEnd(stopReason);
             heldForBackgroundTasks = hold === 'background-tasks';
+            heldForQueuedInput = hold === 'turn-continues' && stopReason !== 'tool_use';
             if (hold === 'close')
                 closeStdinOnce();
             return;
@@ -688,13 +660,12 @@ export function wireChildLifecycle(ctx) {
             return;
         }
         stdoutDiagnostics.feed({ text });
-        // Before the parser: an ack and the aborted turn's end can share a chunk, and the turn end must
-        // see that no interrupt is still waiting (see `stdinHoldAfterTurnEnd`); a background task
-        // starting and the turn's end can share one too.
-        scanControlLines(text);
-        // Non-null: `streamHandler` is only ever null when `streamFormat === 'plain'` (see its
-        // construction above), the branch this statement is provably unreachable from.
-        streamHandler.feed({ chunk: text });
+        // Receipts, background membership and turn ends must be processed in the same wire order.
+        // streamHandler is non-null here: the plain-format branch returned above.
+        if (acceptsMidRunUserMessages({ def }))
+            scanControlLines(text);
+        else
+            streamHandler.feed({ chunk: text });
     });
     child.stderr?.on('data', (chunk) => {
         const text = chunk.toString('utf8');
@@ -717,9 +688,7 @@ export function wireChildLifecycle(ctx) {
             void terminateChildTreeBestEffort(ctx, child, runId, 'cancel', ctx.onCleanupFailure);
         } });
     child.on('close', (code, signal) => {
-        for (const settle of pendingInterruptAcks.values())
-            settle(false);
-        pendingInterruptAcks.clear();
+        stdinClosed = true;
         void (async () => {
             // Not wrapped in try/catch: all 4 supported parser factories'
             // flush() implementations already internally guard their own
@@ -729,7 +698,12 @@ export function wireChildLifecycle(ctx) {
             // here would be dead code for the fixed, closed set of parsers this
             // driver dispatches to. `streamHandler` is null for `'plain'` (no
             // parser, hence nothing to flush) — `?.` skips it cleanly.
+            if (controlScanBuffer) {
+                feedSessionLine(controlScanBuffer);
+                controlScanBuffer = '';
+            }
             streamHandler?.flush();
+            session.endSession();
             stdoutDiagnostics.flush();
             // Queued before `await emitQueue` so the flushed text is durably appended ahead of
             // `finish()`'s `'end'` event, exactly like every live-path emit already is.
@@ -761,63 +735,27 @@ export function wireChildLifecycle(ctx) {
             })
             : false;
     }
-    /**
-     * A mid-run message: first an `interrupt` control request on the still-open stdin, so the agent
-     * stops generating (or abandons the tool it is running) at once instead of finishing its whole
-     * reply; then, once the CLI acknowledges, the message as the next user line, which the CLI
-     * answers straight away in the same session; then the run's own `user_message` event through the
-     * same FIFO as the agent's output, so the message sits in the stream where it took effect.
-     * An ack that never comes (an agent that ignores control requests) only delays the write by
-     * {@link INTERRUPT_ACK_TIMEOUT_MS}: the CLI then folds the line in at its next step. Once
-     * `turn_end` has closed stdin, or the process exits before the ack, there is no session left to
-     * reach — `'not-running'`. Between turns, while stdin is held only for background tasks, there is
-     * no generation to stop: the line is written at once and starts the next turn.
-     * Host-prepared images use the same content blocks as the initial stdin turn; no file tools
-     * or new directory grants are needed to see these pixels.
-     */
-    async function sendUserMessage(text, images = []) {
-        if (!acceptsMidRunUserMessages({ def: def }))
-            return 'unsupported';
+    /** Queue into the existing Claude session without interrupting parallel tools or subagents.
+     * Images use the idle-send encoder without file tools or new directory grants; journals keep
+     * text without base64. HTTP acceptance only
+     * confirms the write; UUID-attributed CLI receipts separately confirm consumption. */
+    async function sendUserMessage({ text, id = randomUUID(), attachmentIds }, { imageContents: images = [] } = {}) {
+        if (!acceptsMidRunUserMessages({ def }))
+            return relay?.enqueue({ id, text, hasAttachments: images.length > 0 || (attachmentIds?.length ?? 0) > 0 }) ?? 'unsupported';
         const stdin = child.stdin;
         if (stdinClosed || !stdin)
             return 'not-running';
-        if (heldForBackgroundTasks) {
-            heldForBackgroundTasks = false;
-            writeUserMessage(stdin, text, images);
-            return 'delivered';
-        }
-        const requestId = `jini-interrupt-${randomUUID()}`;
-        interruptSent = true;
-        // Capture before requesting the interrupt. Its result can precede the acknowledgement, or
-        // arrive after the next segment starts: neither ordering may cancel that segment's new tools.
-        enqueueEmit(async () => {
-            await toolSubscription;
-            for (const id of interruptedToolCalls)
-                if (!unresolvedToolCalls.has(id))
-                    interruptedToolCalls.delete(id);
-            for (const id of unresolvedToolCalls)
-                interruptedToolCalls.add(id);
-        });
-        const acked = new Promise((resolve) => pendingInterruptAcks.set(requestId, resolve));
-        stdin.write(`${JSON.stringify({ type: 'control_request', request_id: requestId, request: { subtype: 'interrupt' } })}\n`, 'utf8');
-        let timer;
-        const timedOut = new Promise((resolve) => {
-            timer = setTimeout(() => resolve(true), INTERRUPT_ACK_TIMEOUT_MS);
-        });
-        const processAlive = await Promise.race([acked, timedOut]);
-        clearTimeout(timer);
-        pendingInterruptAcks.delete(requestId);
-        if (!processAlive || stdinClosed)
-            return 'not-running';
-        writeUserMessage(stdin, text, images);
+        heldForBackgroundTasks = false;
+        writeUserMessage(stdin, text, images, id);
         return 'delivered';
     }
-    /** Writes a complete mid-run turn using the idle image encoder; journals text without base64. */
-    function writeUserMessage(stdin, text, images) {
-        stdin.write(`${JSON.stringify(streamJsonUserMessage({ content: messageContentWithImages({ prompt: text, images }, {}) }))}\n`, 'utf8');
+    /** Writes a complete mid-run turn using the idle image encoder; journals text without base64.
+     * The same UUID identifies stdin, queue acceptance and subsequent consumption receipts. */
+    function writeUserMessage(stdin, text, images, id) {
+        session.queue({ id, text });
+        stdin.write(`${JSON.stringify({ ...streamJsonUserMessage({ content: messageContentWithImages({ prompt: text, images }, {}) }), uuid: id })}\n`, 'utf8');
         if (journal)
-            enqueueEmit(() => journal.record({ runId: runId, entry: sentJournalEntry(text) }));
-        enqueueEmit(() => lifecycle.emit({ runId: runId, input: { event: 'agent', data: { type: 'user_message', id: randomUUID(), text: text } } }));
+            enqueueEmit(() => journal.record({ runId, entry: sentJournalEntry(text) }));
     }
     return {
         closeStdinOnce,
@@ -828,45 +766,6 @@ export function wireChildLifecycle(ctx) {
         sendUserMessage,
     };
 }
-/**
- * Whether a def's live process can take another user message mid-run: only a stream-json stdin
- * transport keeps stdin open for more JSONL user lines (see `RuntimeAgentDef.promptInputFormat`).
- * Deliberately not `resolveContinuationTransport`: that answers how a tool result gets back, and
- * reports `'mcp-callback'` for Claude even though its stdin takes user lines all the same.
- */
-export function acceptsMidRunUserMessages({ def }) {
-    return def.promptViaStdin === true && def.promptInputFormat === 'stream-json';
-}
-/**
- * How long a mid-run message waits for the CLI to acknowledge its interrupt before being written
- * anyway. Claude Code acks within milliseconds (it answers before the aborted turn's own result);
- * the ceiling only bounds an agent that ignores control requests.
- */
-export const INTERRUPT_ACK_TIMEOUT_MS = 5_000;
-/** The `request_id` of a stream-json `control_response` line, or `undefined` for anything else. */
-function controlResponseRequestId({ line }) {
-    try {
-        const parsed = JSON.parse(line);
-        if (!isRecord(parsed) || parsed.type !== 'control_response' || !isRecord(parsed.response))
-            return undefined;
-        return typeof parsed.response.request_id === 'string' ? parsed.response.request_id : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-/** How many tasks a `background_tasks_changed` line lists, or `undefined` for any other line. */
-function backgroundTaskListLength({ line }) {
-    try {
-        const parsed = JSON.parse(line);
-        if (!isRecord(parsed) || parsed.type !== 'system' || parsed.subtype !== 'background_tasks_changed')
-            return undefined;
-        return Array.isArray(parsed.tasks) ? parsed.tasks.length : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
 /** The stream-json stdin envelope for one user message — the initial prompt and every mid-run one. */
 function streamJsonUserMessage({ content }) {
     return { type: 'user', message: { role: 'user', content: content } };
@@ -910,6 +809,9 @@ function wireAcpLifecycle(ctx) {
     function enqueueEmit(task) {
         emitQueue = appendSerialTask({ previous: emitQueue, task, onError: reportDroppedEmit });
     }
+    attachMessageRelay({ register: ctx.registerMessageRelay, child,
+        emit: data => enqueueEmit(() => lifecycle.emit({ runId, input: { event: 'agent', data } })),
+    });
     if (ctx.model)
         enqueueEmit(() => lifecycle.emit({ runId, input: { event: 'agent', data: { type: 'status', label: 'starting_model', model: ctx.model } } }));
     child.stdout?.on('data', (chunk) => {
@@ -1109,6 +1011,7 @@ export function writePromptToStdin(def, child, prompt, handle) {
 export async function runAcpDispatch({ input, deps }) {
     try {
         wireAcpLifecycle({
+            ...(deps.registerMessageRelay ? { registerMessageRelay: deps.registerMessageRelay } : {}),
             runId: input.runId,
             agentId: input.agentId,
             child: input.child,

package/dist/agent-executor/launch.d.ts

@@ -186,10 +186,16 @@ export declare function computeRuntimeContext({ preparedPromptFile, preparedLogF
     readonly resumeSessionId?: string | null;
     readonly newSessionId?: string;
 }): RuntimeContext | undefined;
+type AgentBuildInput = Parameters<typeof buildAgentBuildArgsOptions>[0]['input'];
 /** Phase 9a: the def's `buildArgs` 4th argument. Historically omitted when every override was absent;
  * that let defs silently enable auto-approval. Always supply the validated restricted default now. Pure. */
 export declare function buildAgentBuildArgsOptions({ input, systemPromptOverlay }: {
-    readonly input: Pick<AgentExecutorRunInput, 'model' | 'reasoning' | 'permissionMode' | 'nativeToolAccess' | 'nativeCapabilities' | 'cliParity' | 'disallowedTools' | 'allowedTools' | 'settingSources' | 'settings' | 'chromeIntegration'>;
+    readonly input: Pick<AgentExecutorRunInput, 'filesystemRoot' | 'model' | 'reasoning' | 'permissionMode' | 'nativeToolAccess' | 'nativeCapabilities' | 'cliParity' | 'disallowedTools' | 'allowedTools' | 'settingSources' | 'settings' | 'chromeIntegration'> & {
+        filesystemRuntimeReadPaths?: readonly string[];
+        filesystemTempDir?: string;
+        filesystemSharedTempRoots?: readonly string[];
+        filesystemNotice?: string;
+    };
     readonly systemPromptOverlay: string | null | undefined;
 }): RuntimeBuildOptions;
 /**
@@ -262,7 +268,7 @@ export declare function buildRunArgs({ input, deps }: {
         readonly def: RuntimeAgentDef;
         readonly imageDelivery: ImagePromptDelivery;
         readonly imagePaths: readonly string[] | undefined;
-        readonly runInput: Pick<AgentExecutorRunInput, 'model' | 'reasoning' | 'permissionMode'>;
+        readonly runInput: AgentBuildInput;
         readonly systemPromptOverlay: string | null | undefined;
         readonly overlayDelivery: SystemPromptOverlayDelivery;
         readonly runtimeContext: RuntimeContext | undefined;
@@ -381,6 +387,6 @@ export declare function confirmChildSpawned({ input, deps }: {
  * @complexity `run()`'s own setup is O(1); steady-state cost is the chosen stream parser's.
  * @overallScore 100/100
  */
-export declare function createAgentExecutor(requiredArgs: Pick<CreateAgentExecutorOptions, "lifecycle">, optionalArgs?: Pick<CreateAgentExecutorOptions, "runtimeState" | "codexDisablePlugins" | "piGracefulShutdownMs" | "hostEnv" | "getAgentDef" | "resolveAgentLaunch" | "resolveModelForLaunch" | "ensureAgentCapabilities" | "applyAgentLaunchEnv" | "createCommandInvocation" | "spawn" | "probeMcpBridge" | "attachAcpSession" | "acpPermissionHandler" | "attachPiRpcSession" | "preparePromptFileForAgent" | "prepareAgentLogFile" | "listProcessSnapshots" | "collectProcessTreePids" | "stopProcesses" | "onCleanupFailure" | "journal" | "delegatedResultCorrelation" | "stdoutJournalBlobs" | "continuation" | "classifyFailure" | "mcpJsonInjection" | "claudeConfigDirIsolation" | "claudeConfigDirIsolationEnabled" | "bufferedStdoutMaxBytes" | "promptAugmenter">): AgentExecutor;
+export declare function createAgentExecutor(requiredArgs: Pick<CreateAgentExecutorOptions, "lifecycle">, optionalArgs?: Pick<CreateAgentExecutorOptions, "runtimeState" | "codexDisablePlugins" | "piGracefulShutdownMs" | "hostEnv" | "getAgentDef" | "resolveAgentLaunch" | "resolveModelForLaunch" | "ensureAgentCapabilities" | "assertClaudeFilesystemSupport" | "applyAgentLaunchEnv" | "createCommandInvocation" | "spawn" | "probeMcpBridge" | "attachAcpSession" | "acpPermissionHandler" | "attachPiRpcSession" | "preparePromptFileForAgent" | "prepareAgentLogFile" | "listProcessSnapshots" | "collectProcessTreePids" | "stopProcesses" | "onCleanupFailure" | "journal" | "delegatedResultCorrelation" | "stdoutJournalBlobs" | "continuation" | "classifyFailure" | "mcpJsonInjection" | "claudeConfigDirIsolation" | "claudeConfigDirIsolationEnabled" | "bufferedStdoutMaxBytes" | "promptAugmenter">): AgentExecutor;
 export {};
 //# sourceMappingURL=launch.d.ts.map